Tags: java reverse

Rating: 5.0

# Recovery
Could you help me recovery my number?

File: [recovery.jar](https://mega.nz/#!7OgGlCob!X9ikPVL93_nlsVB3SucyTmEp4MG7PLEmfq6MS2euxfc)

Note: The flag is not in flag format, please wrap it in format when you submit. ISITDTU{x, y, z, ...}

Update: "Pre-order"

### Initial Analysis
For this challenge, we were given a jar file, [recovery.jar](https://github.com/zelinsky/CTF-Writeups/blob/master/ISITDTU/Reverse/Recovery/recovery.jar). This is what we see when we run it:

Let's try entering in some numbers:

So our goal for this challenge is to enter the correct sequence of numbers, and that will be our flag!

### Tools
I used [JD-GUI](https://github.com/java-decompiler/jd-gui), a java decompiler, to look at the code behind this program.

### Decompiling
The main function:

Taking a look at the FrmProblem class, we can see what happens when we click the submit button:

It looks like our input is being checked somehow against the arrays *s* and *l*, and if the function returns true, we have out flag.
Let's see what *check()* is doing:

It's just returning true is the two arrays given are equal. Okay, now let's look at the *getResultA()* and *getResultB()* functions:

These functions are being run on our input. It looks like both functions insert our input into a binary tree. The *getResultA()* function returns the in-order traversal of the tree, and *getResultB()* returns the post-order traversal of the tree.

It's clear what we need to do now. We need to give the program a list of numbers to be inserted into a binary tree such that the in-order traversal is equal to the array *s* and the post-order traversal is equal to the array *l*.